.azure/build-pipeline.yaml

@@ -16,6 +16,8 @@ stages:
     displayName: Java build
     jobs:
       - template: 'templates/jobs/build_java.yaml'
+    variables:
+      STRIMZI_TEST_CONTAINER_LOGGING_ENABLED: false
   - stage: docs_build
     displayName: Docs build
     dependsOn: []

.azure/scripts/install_cosign.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+readonly VERSION="2.2.0"
+
+ARCH=$1
+if [ -z "$ARCH" ]; then
+    ARCH="amd64"
+fi
+
+curl -L https://github.com/sigstore/cosign/releases/download/v${VERSION}/cosign-linux-${ARCH} > cosign && chmod +x cosign
+sudo mv cosign /usr/bin/

.azure/scripts/install_syft.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -e
+
+readonly VERSION="0.90.0"
+
+ARCH=$1
+if [ -z "$ARCH" ]; then
+    ARCH="amd64"
+fi
+
+wget https://github.com/anchore/syft/releases/download/v${VERSION}/syft_${VERSION}_linux_${ARCH}.tar.gz -O syft.tar.gz
+tar xf syft.tar.gz -C /tmp
+chmod +x /tmp/syft
+sudo mv /tmp/syft /usr/bin

.azure/scripts/push-to-nexus.sh

@@ -1,16 +1,23 @@
 #!/usr/bin/env bash
 
+set -e
+
 echo "Build reason: ${BUILD_REASON}"
 echo "Source branch: ${BRANCH}"
 
-GPG_TTY=$(tty)
-export GPG_TTY
+function cleanup() {
+  rm -rf signing.gpg
+  gpg --delete-keys
+  gpg --delete-secret-keys
+}
+
+# Run the cleanup on failure / exit
+trap cleanup EXIT
 
-echo "$GPG_SIGNING_KEY" | base64 -d > signing.gpg
+export GPG_TTY=$(tty)
+echo $GPG_SIGNING_KEY | base64 -d > signing.gpg
 gpg --batch --import signing.gpg
 
 GPG_EXECUTABLE=gpg mvn $MVN_ARGS -DskipTests -s ./.azure/scripts/settings.xml -P ossrh verify deploy
 
-rm -rf signing.gpg
-gpg --delete-keys
-gpg --delete-secret-keys
+cleanup

.azure/templates/jobs/build_container.yaml

@@ -11,10 +11,10 @@ jobs:
     timeoutInMinutes: 60
     # Base system
     pool:
-      vmImage: 'Ubuntu-20.04'
+      vmImage: 'Ubuntu-22.04'
     # Pipeline steps
     steps:
-      - template: '../steps/setup_docker.yaml'
+      - template: '../steps/prerequisites/install_docker.yaml'
       - task: DownloadPipelineArtifact@2
         inputs:
           source: '${{ parameters.artifactSource }}'
@@ -26,7 +26,7 @@ jobs:
           runId: '${{ parameters.artifactRunId }}'
       - bash: tar -xvf target.tar
         displayName: "Untar the target directory"
-      - bash: ".azure/scripts/container-build.sh"
+      - bash: "make docker_build docker_save"
         env:
           DOCKER_BUILDKIT: 1
           BUILD_REASON: $(Build.Reason)

.azure/templates/jobs/build_docs.yaml

@@ -1,12 +1,17 @@
 jobs:
   - job: 'build_docs'
     displayName: 'Build Docs'
+    strategy:
+      matrix:
+        'java-17':
+          image: 'Ubuntu-22.04'
+          jdk_version: '17'
     # Strategy for the job
     # Set timeout for jobs
     timeoutInMinutes: 60
     # Base system
     pool:
-      vmImage: 'Ubuntu-20.04'
+      vmImage: $(image)
     # Variables
     variables:
       MVN_CACHE_FOLDER: $(HOME)/.m2/repository
@@ -15,11 +20,10 @@ jobs:
     steps:
       # Get cached Maven repository
       - template: "../steps/maven_cache.yaml"
-      - template: '../steps/setup_java.yaml'
+      - template: '../steps/prerequisites/install_java.yaml'
         parameters:
-          JDK_PATH: '/usr/lib/jvm/java-11-openjdk-amd64'
-          JDK_VERSION: '11'
-      - template: '../steps/setup_asciidoc.yaml'
+          JDK_VERSION: $(jdk_version)
+      - template: '../steps/prerequisites/install_asciidoc.yaml'
       - bash: "make docu_html docu_htmlnoheader"
         displayName: "Build docs"
         env:

.azure/templates/jobs/build_java.yaml

@@ -4,16 +4,10 @@ jobs:
     # Strategy for the job
     strategy:
       matrix:
-        'java-11':
-          image: 'Ubuntu-20.04'
-          jdk_version: '11'
-          jdk_path: '/usr/lib/jvm/java-11-openjdk-amd64'
-          main_build: 'true'
         'java-17':
-          image: 'Ubuntu-20.04'
+          image: 'Ubuntu-22.04'
           jdk_version: '17'
-          jdk_path: '/usr/lib/jvm/java-17-openjdk-amd64'
-          main_build: 'false'
+          main_build: 'true'
     # Set timeout for jobs
     timeoutInMinutes: 60
     # Base system
@@ -27,21 +21,20 @@ jobs:
     steps:
       # Get cached Maven repository
       - template: "../steps/maven_cache.yaml"
-      - template: '../steps/setup_java.yaml'
+      - template: '../steps/prerequisites/install_java.yaml'
         parameters:
-          JDK_PATH: $(jdk_path)
           JDK_VERSION: $(jdk_version)
-      - bash: "make spotbugs"
-        displayName: "Spotbugs"
-        env:
-          MVN_ARGS: "-e -V -B"
-      - bash: ".azure/scripts/java-build.sh"
+      - bash: "make java_verify"
         displayName: "Build & Test Java"
         env:
           BUILD_REASON: $(Build.Reason)
           BRANCH: $(Build.SourceBranch)
           TESTCONTAINERS_RYUK_DISABLED: "TRUE"
           TESTCONTAINERS_CHECKS_DISABLE: "TRUE"
+          MVN_ARGS: "-e -V -B"          
+      - bash: "make spotbugs"
+        displayName: "Spotbugs"
+        env:
           MVN_ARGS: "-e -V -B"
       # We have to TAR the target directory to maintain the permissions of
       # the files which would otherwise change when downloading the artifact

.azure/templates/jobs/deploy_java.yaml

@@ -1,13 +1,21 @@
 jobs:
   - job: 'deploy_java'
     displayName: 'Deploy Java'
+    # Strategy for the job
+    strategy:
+      matrix:
+        'java-17':
+          image: 'Ubuntu-22.04'
+          jdk_version: '17'
+          main_build: 'true'
     # Set timeout for jobs
     timeoutInMinutes: 60
     # Base system
     pool:
-      vmImage: 'Ubuntu-20.04'
+      vmImage: 'Ubuntu-22.04'
     # Pipeline steps
     steps:
+      - template: '../steps/prerequisites/install_java.yaml'
       - task: DownloadPipelineArtifact@2
         inputs:
           source: '${{ parameters.artifactSource }}'

.azure/templates/jobs/publish_docs.yaml

@@ -5,7 +5,7 @@ jobs:
     timeoutInMinutes: 60
     # Base system
     pool:
-      vmImage: 'Ubuntu-20.04'
+      vmImage: 'Ubuntu-22.04'
     # Pipeline steps
     steps:
       - task: DownloadPipelineArtifact@2

.azure/templates/jobs/push_container.yaml

@@ -5,10 +5,12 @@ jobs:
     timeoutInMinutes: 60
     # Base system
     pool:
-      vmImage: 'Ubuntu-20.04'
+      vmImage: 'Ubuntu-22.04'
     # Pipeline steps
     steps:
-      - template: '../steps/setup_docker.yaml'
+      - template: '../steps/prerequisites/install_docker.yaml'
+      - template: "../steps/prerequisites/install_cosign.yaml"
+      - template: "../steps/prerequisites/install_syft.yaml"
       - ${{ each arch in parameters.architectures }}:
         - task: DownloadPipelineArtifact@2
           inputs:
@@ -19,14 +21,82 @@ jobs:
             pipeline: '${{ parameters.artifactPipeline }}'
             runVersion: '${{ parameters.artifactRunVersion }}'
             runId: '${{ parameters.artifactRunId }}'
-      - bash: ".azure/scripts/container-push.sh"
+      # Push containers and their manifests
+      - bash: "docker login -u $DOCKER_USER -p $DOCKER_PASS $DOCKER_REGISTRY"
+        displayName: "Login to container registry"
         env:
           BUILD_REASON: $(Build.Reason)
           BRANCH: $(Build.SourceBranch)
           DOCKER_USER: $(QUAY_USER)
           DOCKER_PASS: $(QUAY_PASS)
           DOCKER_REGISTRY: "quay.io"
+      - bash: "make docker_delete_manifest"
+        displayName: "Delete existing container manifest"
+        env:
+          BUILD_REASON: $(Build.Reason)
+          BRANCH: $(Build.SourceBranch)
+          DOCKER_REGISTRY: "quay.io"
           DOCKER_ORG: "strimzi"
           DOCKER_TAG: '${{ parameters.dockerTag }}'
-          ARCHITECTURES: ${{ join(' ', parameters.architectures) }}
-        displayName: "Tag & Push container"
+      - ${{ each arch in parameters.architectures }}:
+          - bash: make docker_load docker_tag docker_push docker_amend_manifest docker_delete_archive
+            displayName: "Push the ${{ arch }} containers and create manifest"
+            env:
+              BUILD_REASON: $(Build.Reason)
+              BRANCH: $(Build.SourceBranch)
+              DOCKER_REGISTRY: "quay.io"
+              DOCKER_ORG: "strimzi"
+              DOCKER_TAG: '${{ parameters.dockerTag }}'
+              DOCKER_ARCHITECTURE: ${{ arch }}
+      - bash: "make docker_push_manifest"
+        displayName: "Push container manifest"
+        env:
+          BUILD_REASON: $(Build.Reason)
+          BRANCH: $(Build.SourceBranch)
+          DOCKER_REGISTRY: "quay.io"
+          DOCKER_ORG: "strimzi"
+          DOCKER_TAG: '${{ parameters.dockerTag }}'
+      - bash: "make docker_sign_manifest"
+        displayName: "Sign container manifest"
+        env:
+          BUILD_REASON: $(Build.Reason)
+          BRANCH: $(Build.SourceBranch)
+          BUILD_ID: $(Build.BuildId)
+          BUILD_COMMIT: $(Build.SourceVersion)
+          DOCKER_REGISTRY: "quay.io"
+          DOCKER_ORG: "strimzi"
+          DOCKER_TAG: '${{ parameters.dockerTag }}'
+          COSIGN_PASSWORD: $(COSIGN_PASSWORD)
+          COSIGN_PRIVATE_KEY: $(COSIGN_PRIVATE_KEY)
+      # SBOMs generation, packaging, and signing
+      - ${{ each arch in parameters.architectures }}:
+          - bash: make docker_sbom
+            displayName: "Generate SBOMs for ${{ arch }} container"
+            env:
+              BUILD_REASON: $(Build.Reason)
+              BRANCH: $(Build.SourceBranch)
+              DOCKER_REGISTRY: "quay.io"
+              DOCKER_ORG: "strimzi"
+              DOCKER_TAG: '${{ parameters.dockerTag }}'
+              DOCKER_ARCHITECTURE: ${{ arch }}
+              COSIGN_PASSWORD: $(COSIGN_PASSWORD)
+              COSIGN_PRIVATE_KEY: $(COSIGN_PRIVATE_KEY)
+      - bash: tar -z -C ./sbom/ -cvpf sbom.tar.gz ./
+        displayName: "Tar the SBOM files"
+      - publish: $(System.DefaultWorkingDirectory)/sbom.tar.gz
+        artifact: SBOMs-${{ parameters.dockerTag }}
+        displayName: "Publish the SBOM files"
+      # push the SBOMs to container registry only for releases
+      - ${{ each arch in parameters.architectures }}:
+          - bash: make docker_push_sbom
+            displayName: "Push SBOMs for ${{ arch }} container"
+            condition: startsWith(variables['build.sourceBranch'], 'refs/heads/release-')
+            env:
+              BUILD_REASON: $(Build.Reason)
+              BRANCH: $(Build.SourceBranch)
+              DOCKER_REGISTRY: "quay.io"
+              DOCKER_ORG: "strimzi"
+              DOCKER_TAG: '${{ parameters.dockerTag }}'
+              DOCKER_ARCHITECTURE: ${{ arch }}
+              COSIGN_PASSWORD: $(COSIGN_PASSWORD)
+              COSIGN_PRIVATE_KEY: $(COSIGN_PRIVATE_KEY)

.azure/templates/steps/prerequisites/install_cosign.yaml

@@ -0,0 +1,3 @@
+steps:
+  - bash: ".azure/scripts/install_cosign.sh"
+    displayName: "Install cosign"

.azure/templates/steps/setup_docker.yaml → .azure/templates/steps/prerequisites/install_docker.yaml

@@ -1,9 +1,10 @@
 # Steps needed for local Docker installation
 steps:
   - task: DockerInstaller@0
-    displayName: Docker Installer
+    displayName: Install Docker
     inputs:
-      dockerVersion: 20.10.8
+      # Versions can be found from https://download.docker.com/linux/static/stable/x86_64/
+      dockerVersion: 24.0.5
       releaseType: stable
   - bash: |
       docker run --rm --privileged multiarch/qemu-user-static --reset -p yes

.azure/templates/steps/prerequisites/install_java.yaml

@@ -0,0 +1,11 @@
+# Step to configure JAVA on the agent
+parameters:
+  - name: JDK_VERSION
+    default: '17'
+steps:
+  - task: JavaToolInstaller@0
+    inputs:
+      versionSpec: $(JDK_VERSION)
+      jdkArchitectureOption: 'x64'
+      jdkSourceOption: 'PreInstalled'
+    displayName: 'Configure Java'

.azure/templates/steps/prerequisites/install_syft.yaml

@@ -0,0 +1,3 @@
+steps:
+  - bash: ".azure/scripts/install_syft.sh"
+    displayName: "Install Syft"